Read the docs
TI-2008-06911 Aliases CVE-2008-7223GHSA-8mv3-24h6-22v7

Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.3 allow remote…

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via (1) ftp/index.php, (2) viewer.php, (3) functions/other.php, (4) include/left_menu.class.php, or (5) plugins/stats/stats_view.php.

Why it matters now

EPSS 0.01199 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:linpha:linpha:*:*:*:*:*:*:*:*up to 1.3.2VulnerableLinpha
cpe:2.3:a:linpha:linpha:0.9.0:*:*:*:*:*:*:*0.9.0VulnerableLinpha
cpe:2.3:a:linpha:linpha:0.9.1:*:*:*:*:*:*:*0.9.1VulnerableLinpha
cpe:2.3:a:linpha:linpha:0.9.2:*:*:*:*:*:*:*0.9.2VulnerableLinpha
cpe:2.3:a:linpha:linpha:0.9.3:*:*:*:*:*:*:*0.9.3VulnerableLinpha
cpe:2.3:a:linpha:linpha:0.9.4:*:*:*:*:*:*:*0.9.4VulnerableLinpha
cpe:2.3:a:linpha:linpha:1.0:*:*:*:*:*:*:*1.0VulnerableLinpha
cpe:2.3:a:linpha:linpha:1.0:beta1:*:*:*:*:*:*1.0 beta1VulnerableLinpha
cpe:2.3:a:linpha:linpha:1.0:beta2:*:*:*:*:*:*1.0 beta2VulnerableLinpha
cpe:2.3:a:linpha:linpha:1.0:beta3:*:*:*:*:*:*1.0 beta3VulnerableLinpha
  • cpe:2.3:a:linpha:linpha:*:*:*:*:*:*:*:* Versions up to 1.3.2 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:1.0:beta1:*:*:*:*:*:* Versions 1.0 beta1 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:1.0:beta2:*:*:*:*:*:* Versions 1.0 beta2 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:1.0:beta3:*:*:*:*:*:* Versions 1.0 beta3 Vulnerable ·Linpha
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:linpha:linpha:1.0:rc1:*:*:*:*:*:*1.0 rc1VulnerableLinpha
cpe:2.3:a:linpha:linpha:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableLinpha
cpe:2.3:a:linpha:linpha:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableLinpha
cpe:2.3:a:linpha:linpha:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableLinpha
cpe:2.3:a:linpha:linpha:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableLinpha
cpe:2.3:a:linpha:linpha:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableLinpha
  • cpe:2.3:a:linpha:linpha:1.0:rc1:*:*:*:*:*:* Versions 1.0 rc1 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Linpha
  • cpe:2.3:a:linpha:linpha:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Linpha

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-7223
  2. 2026-10-03 Alias added: GHSA-8mv3-24h6-22v7

References

Patch 1

Other 2

  • TI-2007-03921 SQL injection vulnerability in include/img_view.class.php in LinPHA 1.3.1 and earlier… CVSS 2.0HIGH 7.5
  • TI-2004-01939 SQL injection vulnerability in session.php in LinPHA 0.9.4 allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2006-01869 SQL injection vulnerability in functions/db_api.php in LinPHA 1.1.1 allows remote… CVSS 2.0MEDIUM 6.4
  • TI-2006-01868 Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.1.1 allow remote… CVSS 2.0MEDIUM 5.8
  • TI-2008-01783 plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication… CVSS 2.0MEDIUM 5.1
  • TI-2006-00692 Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include… CVSS 2.0MEDIUM 5.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences